EXPOSURES › CVE-2017-7525
CVE-2017-7525
CRITICAL
DETAIL
SourceNVD · cve
Published2018-02-06
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-7525 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendordebian · vendorfasterxml · vendorredhat · vendorbanking platform · productcommunications billing and revenue management · productcommunications communications policy management · productcommunications diameter signaling route · productcommunications instant messaging server · productdebian linux · productenterprise linux server · productenterprise manager for virtualization · productfinancial services analytical applications infrastructure · productglobal lifecycle management opatchauto · productjackson-databind · productjboss enterprise application platform · productoncommand balance · productoncommand performance manager · productoncommand shift · productopenshift container platform · productprimavera unifier · productsnapcenter · productutilities advanced spatial and operational analytics · productvirtualization · productvirtualization host · productwebcenter portal · product
DESCRIPTION
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No coverage or sentiment toward vendor found in provided sources.
Neutral; technical description only.
"A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper."
Neutral; no content.
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |